A project is faced with risks at every phase of its life cycle. These risks may be expected or unexpected, and when encountered, needs time and attention. Depending on the type of risk, a risk can be a boost or a hindrance to a project.
In order to understand the many risks that a project faces, a qualitative and quantitative analysis of risks in a project has to be done. While quantitative analysis assigns a numerical value to the risk, qualitative analysis, on the other hand, indicates the probability and the impact of the risk on the project in terms of seriousness and urgency.
A project risk matrix is used when ‘qualitatively’ analyzing risks. It is a process of rating a risk’s probability against its impact. It is applied to individual risks and not to a group of risks in a risk sequence or to complete project as such. A sample of a project risk matrix is illustrated below.
Example of a Probability Impact Matrix
A probability-impact matrix is used to highlight the status of risks at a glance. There are many ways of expressing the probability and impact relationship of risks in a project. The most popular way, however, is to rate them as Very High, High, Medium, Low, and so on.
Risks with higher probability and higher impact will require more attention, and hence this risk assessment tool is most useful for project managers trying to reduce risks.
Let us assume in this sample of a project risk matrix, nine individual risks have been identified in a project (refer to the diagram). They are marked against a rating scale of High, Medium and Low for both Probability and Impact.
Risk 1: Low probability and low impact
Risk 2: Medium probability and low impact
Risk 3: High probability and low impact
Risk 4: Low probability and medium impact
Risk 5: Medium probability and medium impact
Risk 6: High probability and medium impact
Risk 7: Low probability and high impact
Risk 8: Medium probability and high impact
Risk 9: High probability and high impact
Risks with a low probability and low impact do not pose much of a threat to a project. They may be easily handled by the project manager/project team and might require supervision or superficial monitoring. As the impact of the risk on a project increases, more time, attention and detailed risk management might be required, by not only the project team, but also all stakeholders involved. An identified risk with a high probability and impact may require additional funds, time and resources to overcome it. It is indicative of urgent attention required.
When a probability-rating score has been assigned to a risk as in 1-6 in the diagram, it becomes easy for all the stakeholders involved to assess the damage a risk might pose to a project, which becomes part of the risk assessment report. The higher the P-I Score, the more aggressive the risk management approach should be.
Assessment of individual risks as in the probability-impact matrix helps with decision making during risk management.
Image Credit: Diagram created by author